function _DriverEntry(pDriverObject: PDRIVER_OBJECT; RegistryPath: PUnicodeString): NTSTATUS; stdcall;
implementation
var
DeviceName1, DeviceName2: UNICODE_STRING;
const
IOCTL_SETPROC = $0022E14B;
function KeServiceDescriptorTable1: PServiceDescriptorEntry;
begin
Result := PPointer(@KeServiceDescriptorTable)^;
end;
function DispatchCreateClose(p_DeviceObject: PDEVICE_OBJECT; p_Irp: PIRP): NTSTATUS; stdcall;
begin
DbgPrint('DisPatchCreate!');
p_Irp^.IoStatus.Status := STATUS_SUCCESS;
p_Irp^.IoStatus.Information := 0;
IofCompleteRequest(p_Irp, IO_NO_INCREMENT);
result := STATUS_SUCCESS;
end;
function DispatchControl(p_DeviceObject: PDEVICE_OBJECT; p_Irp: PIRP): NTSTATUS; stdcall;
var
status: NTSTATUS;
pIrpStack: PIO_STACK_LOCATION;
uIoControlCode: DWORD;
pInputBuffer, pOutputBuffer: Pointer;
uOutsize: Cardinal; //uInsize
uIndex: ULONG;
pBase: PULONG;
begin
status := STATUS_INVALID_DEVICE_REQUEST; ;
pIrpStack := IoGetCurrentIrpStackLocation(p_Irp); {È¡IRPµÄstack locationµÄÖ¸Õë}
uIoControlCode := pIrpStack^.Parameters.DeviceIoControl.IoControlCode;
pInputBuffer := pIrpStack^.Parameters.DeviceIoControl.Type3InputBuffer;
pOutputBuffer := p_Irp^.UserBuffer;
// uInsize := pIrpStack^.Parameters.DeviceIoControl.InputBufferLength;
uOutsize := pIrpStack^.Parameters.DeviceIoControl.OutputBufferLength;
DbgPrint('DispatchDeviceControl Code:%X', uIoControlCode);
case uIoControlCode of
IOCTL_SETPROC:
begin
ProbeForRead(pInputBuffer, sizeof(ULONG), sizeof(ULONG));
ProbeForWrite(pOutputBuffer, sizeof(ULONG), sizeof(ULONG));
uIndex := PULONG(pInputBuffer)^;
if (KeServiceDescriptorTable1^.NumberOfServices <= uIndex) then
begin
status := STATUS_INVALID_PARAMETER;
Result := status;
Exit;
end;
pBase := KeServiceDescriptorTable1^.ServiceTableBase;
DbgPrint('0x%x 0x%x', uIndex, PULONG(pInputBuffer)^);
asm //¹ØÖжÏ
cli
mov eax,cr0
and eax,not $10000
mov cr0,eax
end;
// PULONG(DWORD(pBase) + uIndex)^ := PULONG(pInputBuffer)^;
PULONG(DWORD(pBase) + uIndex * SizeOf(ULONG))^ := PULONG(pInputBuffer)^;
// Inc(pBase, uIndex);
// pBase^ := PULONG(pInputBuffer)^;
asm //¿ªÖжÏ
mov eax,cr0
or eax,$10000
mov cr0,eax
sti
end;
status := STATUS_SUCCESS;
end;
else
begin
Result := status;
Exit;
end;
end;
if status = STATUS_SUCCESS then
p_Irp^.IoStatus.Information := uOutsize
else
p_Irp^.IoStatus.Information := 0;
p_Irp^.IoStatus.Status := status;
IoCompleteRequest(p_Irp, IO_NO_INCREMENT);
Result := status;
end;
procedure DriverUnload(p_DriverObject: PDRIVER_OBJECT); stdcall;
begin
if IoDeleteSymbolicLink(@DeviceName2) <> STATUS_SUCCESS then
DbgPrint('DeleteSymbolicLink Fail!');
IoDeleteDevice(p_DriverObject^.DeviceObject);
end;
function _DriverEntry(pDriverObject: PDRIVER_OBJECT; RegistryPath: PUnicodeString): NTSTATUS; stdcall;
var
status: NTSTATUS;
pDeviceObject: TDeviceObject;
begin
status := STATUS_DEVICE_CONFIGURATION_ERROR;
RtlInitUnicodeString(DeviceName1, '\Device\RESSDT');
RtlInitUnicodeString(DeviceName2, '\??\RESSDTDOS');
if (IoCreateDevice(pDriverObject, 0, @DeviceName1, FILE_DEVICE_UNKNOWN, 0, FALSE, pDeviceObject) = STATUS_SUCCESS) then
begin
if (IoCreateSymbolicLink(@DeviceName2, @DeviceName1) = STATUS_SUCCESS) then
begin
pDriverObject^.MajorFunction[IRP_MJ_CREATE] := @DispatchCreateClose;
pDriverObject^.MajorFunction[IRP_MJ_CLOSE] := @DispatchCreateClose;
pDriverObject^.MajorFunction[IRP_MJ_DEVICE_CONTROL] := @DispatchControl;
pDriverObject^.DriverUnload := @DriverUnload;
status := STATUS_SUCCESS;
end else
begin
DbgPrint('IoCreateSymbolicLink fail!');
IoDeleteDevice(@pDeviceObject);
end;
end else
DbgPrint('IoCreateDevice Fail!');
result := status;
end;
